Splunk Inc. (NASDAQ:SPLK) Q1 2023 Earnings Conference Call May 25, 2022 4:30 PM ET

Company Participants

Ken Tinsley - Corporate Treasurer & Vice President of Investor Relations

Gary Steele - Interim Chief Executive Officer

Jason Child - Chief Financial Officer

Conference Call Participants

Kash Rangan - Goldman Sachs

Brent Thill - Jefferies

Brad Zelnick - Deutsche Bank

Raimo Lenschow - Barclays

Phil Winslow - Credit Suisse

Sanjit Singh - Morgan Stanley

Chirag Ved - Evercore ISI

Steve Koenig - SMBC Nikko Securities

Matt Hedberg - RBC Capital Markets

Keith Bachman - BMO Capital Markets

Brad Sills - BofA Securities

Michael Turits - KeyBanc Capital Markets

Rob Owens - Piper Sandler

Operator

Thank you for standing by, and welcome to Splunk's First Quarter 2023 Financial Results Conference Call. At this time, all participants are in listen-only mode. After the speakers' presentation, there will be a question-and-answer session. [Operator Instructions] As a reminder, today's program is being recorded.

I would now like to introduce your host for today's program, Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Please go ahead, sir.

Ken Tinsley

Thank you, operator, and good afternoon. With me on the call today are Gary Steele and Jason Child.

After market closed today, we issued our earnings press release, which is posted on our Investor Relations website, along with supplemental material. This conference call is being broadcast live via webcast, and following the call, an audio replay will be available on our website.

On today's call, we will be making forward-looking statements, including financial guidance and expectations, including our forecast for our second quarter and full year fiscal 2023 and our expectations of revenues, renewals, operating margin, operating cash flow and rule of 40 scale, as well as trends in our markets and business, our strategies and our expectations regarding our business, products, technology, customers, demand and markets. These statements are subject to risks and uncertainties and based on our assumptions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us. Actual events or results may differ materially.

Please refer to documents we file with the SEC, including the 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures, which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

So with that, let me turn it over to Gary.

Gary Steele

Good afternoon. I'm thrilled to join my first Splunk earnings call, reconnect with many of you and talk with those of you I haven't met yet. It's been an amazing six weeks for me as I rapidly come up to speed on the business and the opportunities in front of us.

I'd first like to thank Splunk Chair, Graham Smith, for leading the team during our CEO transition. I recognize that such periods of uncertainty can create distractions, but this team stayed focused and drove solid execution in the quarter. I'm excited to report that we grew total revenues by 34% to $674 million and Cloud revenues by 66% to $323 million, reflecting strong customer demand and bookings momentum. Jason will dive deeper into the numbers in a few minutes.

I'd like to start by sharing what inspired me to join Splunk, what I've learned so far and my initial priorities. Coming from a cyber background, I'd always admire Splunk for the role that it has played in providing the largest companies in the world, unparalleled visibility that is essential to security teams to understand what's happening in their environment. Given this data-centric approach, I also fundamentally believe that there was so much more that could be done in that context given the complexity of an ever-growing attack surface and an unrelenting threat environment.

Additionally, through my discussions with the Board, Splunkers and customers, I began to understand the true power of this Splunk platform and the value it's bringing to organizations that are leveraging it for observability as well as many other use cases. What I came to learn is that Splunk is the technology underpinning and powering many of the largest companies in the world. Splunk is a system of record that's deeply embedded within customers' businesses and provides the foundation for security and resilience so they can innovate with speed and agility. All of this translated to a massive untapped unique opportunity from which I believe we can drive long-term durable growth while progressively increasing operating margins and cash flow.

Over the past couple of years, as Splunk transformed itself to a cloud company, it also positioned itself on a growth path with the critical ingredients to grow from over $3 billion in ARR to $5 billion and beyond. Underlying all of this is a loyal customer base that continues to expand their usage of Splunk. For example, in Q1, our cloud dollar-based net retention was over 130%, a metric that is best-in-class among all SaaS companies.

With the proliferation of digital and cloud transformation, security, IT and DevOps teams are faced with an ever-evolving threat landscape, increased complexity from piling on more and more tools across hybrid and multi-cloud environments and the silos created by all these data sources and fragmented teams that lead to inefficient detection and resolution. There is an enormous market opportunity to help customers navigate this new reality.

Splunk provides insight into all data across the entire organization to ensure our customers' security, resilience and agility to innovate. For example, a global IT services provider and new Splunk customer selected us in the first quarter for a multimillion dollar deal to oversee their knock and stock with a focus on improving security and cyber resilience. This customer, like many of our largest, saw the value in having highly scalable unified solutions for security and observability on a common platform. This three-year cloud deal replaced their legacy SIM.

As another example, a global apparel company extended their use of Splunk during the quarter with a multimillion dollar order. Whether tech ops organization has already been standardized on Splunk for cloud-based logging and observability, their security organization was using a different security platform that lack adequate scalability and insight into organization-wide data. The customer expanded Splunk across both tech ops and security in parallel. This decision enabled them to gain value from the same data but for different use cases, which reduce their total cost of ownership while broadening visibility across their system.

My third story is a workload pricing deal. We were selected as the best cloud-based solution for a growing financial services company serving millions of consumers. Delivering a scalable and efficient solution that provides greater visibility, we replaced their long existing SIM provider. This deal underscored our platform's ability to consolidate customers' existing tools to reduce outages and mitigate business risk to help protect end customers.

The common thread that runs through these customer stories is there a unique ability to get full fidelity, real-time visibility into their data, which traverses their on-prem and multi-cloud environments at virtually unlimited scale and velocity. Our customers use Splunk to immediately realize actionable insights, irrespective of the use case, be it security, ITOps, DevOps or countless other operational challenges.

And let me be very clear on this point. We offer unique technical attributes that no other company provides. Our customers deeply trust Splunk with the security of their most critical business processes which is why we've earned the right to support broader aspects of their organization. And based on that trust, customers commit to Splunk for the long-term. I look back at our 100 largest customers in each of the last 12 quarters. And on average, our retention rate with these customers is over 99%.

Delivering such high value continues to earn us industry recognition. Already this year, Gartner has named us the top market share leader across security and IT operations and the only vendors to support all three approaches to AIOps, including data and analytics tools, AIOps features and AIOps platforms. We've also been recognized by Constellation, GigaOm and Research in Action for leading the observability market.

I've been overwhelmed by Splunkers' passion and high energy, and we have an exceptional base of talent serving our customers. I continue to meet with our teams around the world to understand our go-to-market and product opportunities. From these conversations, I see an opportunity for more streamlined processes across the company.

In line with this, my first priority has been to increase internal speed and agility across our people and organizations. Flattening our org structure will help us do that. You noticed that following the departure of Teresa Carlson, we did not backfill her role as President of go-to-market. Today, we're also announcing the departure Shawn Bice, President of Products and Technology, and we will not backfill his position either. I will be hands-on with the go-to-market and product leadership teams with an emphasis on scaling efficiently where we can. We appreciate your contributions here, Shawn, and wish you the best of luck in your next endeavor.

Last week, we announced that Petra Jenner has joined the company as our General Manager of EMEA. Petra brings over 25 years in leadership roles with Salesforce, Microsoft and others, and she'll oversee go-to-market strategy in the region. Welcome, Petra. We've also added our newly appointed Chief Customer Officer, Katie Bianchi, to our executive leadership team. As a tenured Splunker, Katie leaves 1,200 people on our customer success and professional services teams tasked to help customers deploy Splunk and accelerate their time to value.

The other top line priorities for me are business execution and strategy. We have to know what customers need in order to execute well. And so I've set the personal objective with the field to meet with 100 customers in my first 100 days of Splunk. It's an ambitious goal, I realize, but it's imperative for me to get deep and broad knowledge of how our customers view our engagement along with the value and service levels we deliver. These inputs will be critical to product and go-to-market decisions.

I look forward to meeting with customers over the next several months as I travel worldwide. And during our annual customer event .conf this June 13 through 16 at the MGM Grand in Las Vegas, join us in person or virtually to hear our exciting product announcements and how customers like Stripe, Papa John's, REI, Nubank, Heineken and many other industry leaders use Splunk to stay secure and resilient as they innovate with speed and agility.

In closing, I'm eager to build upon the exceptionally strong foundation that many Splunk visionaries before me have built. As our recent momentum demonstrates, this is the best time to be here at Splunk. We have an enormous opportunity to grow our business into a global enterprise software and services provider, and I'm excited to lead this team during our path to $10 billion in revenue and beyond. My sincere thanks to each and every Splunker and all of our customers for your continued commitment.

Now I'll turn the call over to Jason.

Jason Child

Thanks, Gary.

Q1 was a good start to the year with total revenues of $674 million, up 34% over last year and Cloud revenue of $323 million, up 66%. Total revenues were significantly higher than expected, reflecting more normalization in our model, plus higher term contract volume, mostly from several very large renewals. Q1 Cloud revenue was also up sharply over last year, reflecting continued customer adoption of our cloud platform. Professional and Services and Education accounted for 7% of total revenues in the quarter.

As I said last quarter, with revenue normalizing and average term contract duration more comparable on a year-over-year basis, RPO bookings is becoming a better indicator of overall bookings momentum. In Q1, RPO bookings was $491 million, up 32% over last year, reflecting strong customer demand.

Our customer retention and expansion rates continue on their very impressive track, thanks to our strong product and services value proposition as well as our customer-centric support approach. Our cloud DBNRR was 130% in Q1 and has been remarkably steady at this level since we first disclosed it several years ago. We ended the quarter with total ARR of $3.21 billion, up 30% year-over-year and cloud ARR of $1.4 billion, up 60%. We had 690 customers with ARR greater than $1 million, up 28% and 329 of these customers had a cloud ARR of $1 million, up 62% over last year.

On to margins, which are all non-GAAP. Cloud gross margin was 68% in Q1, up 7 points from last year as we continue to realize leverage from scale and elasticity of the platform. Total gross margin was 75%, up 3 points year-over-year and reflecting a sharp improvement in cloud margin. Operating margin was negative 8.5% in the quarter, significantly better than planned due to our top line outperformance and some modest expense optimization.

For our EPS calculation, although it doesn't apply this quarter, it's important to note that we've adopted ASU 2020-06, which includes the share impact attributable to our convertible notes. So for modeling purposes, if you estimate a GAAP, non-GAAP net income position in any future period, you should add 22.3 million shares to our fully diluted weighted average share count.

Turning to guidance. For Q2, we expect total revenues of between $735 million and $755 million, with a non-GAAP operating margin of between negative 8% and negative 11%. Looking further out, due to our outperformance in Q1, plus the strength of our renewal base and solid execution, we are increasing our full year revenue expectation by $50 million to between $3.3 billion and $3.35 billion. And we now expect a non-GAAP operating margin of about 2%, which is at the top of our previously guided range.

We are maintaining our total ARR and Cloud ARR full year targets, and we're reaffirming our operating cash flow expectation of at least $400 million for the year. So with revenue normalizing and cash flow now reflecting our change in customer billing terms from 3 years ago, traditional growth and profitability metrics are becoming more meaningful. This year, we're tracking to around 35% on a rule of 40 scale based on OCF, which is a nice step-up to the 25% last year and demonstrating the earnings power of our model.

In closing, execution in Q1 was solid and were set up for a great year. With the impacts from our business transformation mostly behind us, the growth of our business and leverage in our model are becoming clear.

With that, let's open it up for questions.

Question-and-Answer Session

Operator

[Operator Instructions]. Our first question comes from the line of Kash Rangan from Goldman Sachs.

Kash Rangan

Congratulations on the quarter, Gary, nice to meet you. And I'm curious to get your perspective on when you look at Splunk as a business asset, I know you've certainly talked about your ambition to get the company to $5 billion maybe even $10 billion of revenue. What are the things that excite you the most about Splunk, if you can just expand on that, that would be great? And also, this is a very interesting time in the market. Everybody is worried about contraction in GDP inflation, that sort of thing. What is your overall sense as to how the Splunk portfolio could hold up in the event of a more challenging crosscurrent of labor markets, inflation, rates, et cetera. Sorry for the long-winded question, but curious to get your perspective.

Gary Steele

No problem, Kash. Nice to meet you. On the first part of the question, the things that really excite me here are: one, how deeply embedded Splunk is in some of the largest companies in the world. The way in which we underlie everything they're doing from a security perspective and how they're running their IT operations is incredibly impressive. And it really plays out in our dollar-based net retention. And so I think that we're just in a very unique position where we're delivering tremendous [indiscernible] and I think there's so much more that we can do in the market. I think I'd say that was the #1 thing that really got me excited when I got here roughly six weeks ago.

Now going to your question about the macro environment. One of the things that I'm personally encouraged by is that while there's lots of turbulence and a number of factors in the macro environment, the reality is that given the security environment that we're living in with increasing concerns about what might happen relative to Ukraine, the continued concern about ransomware and other issues, Splunk sits right at the center of providing the visibility that security organizations need to understand what's happening.

And so while there could be less than favorable market conditions, we're really mission critical in the that we're delivering and you extend that more broadly to the underpinning of all their critical apps. I think we're in a very good position to weather whatever storm might be ahead.

Kash Rangan

Wonderful. Congrats and look forward to the journey ahead.

Operator

Our next question comes from the line of Brent Thill from Jefferies.

Brent Thill

Gary, welcome. Congrats on the role. During the quarter, the license component was very strong versus cloud. And I'm just curious if you could walk through perhaps what you saw on that. And for Jason, maybe if you could just address the security versus non-security components of the story. I would assume the security business continue to do very well like your peers have been doing. Can you talk about the non-security aspects of the business? Are you seeing the same level of strength there? Any color would be helpful.

Gary Steele

Yes, I'll start, and I'll let Jason jump in here. So from a mix perspective, we saw strength both in cloud and in on-prem. We're seeing many of our large customers work through the details of a migration to cloud. As we look across the whole year, we're very much encouraged by the level of momentum and interest we see there. And I'll let Jason speak to some of the specifics as it relates to the exact number.

Jason Child

Yes. In terms of the security business, consistent with prior periods, it continues to be around 50% of the business. It is the fastest-growing part of the business, at least on a dollar basis. And I would say that the remainder of the business, which is really IT observability platform, those businesses continue to do well, but security is still the largest percentage of the business.

Operator

Our next question comes from the line of Brad Zelnick from Deutsche Bank.

Brad Zelnick

Thank you very much, and congrats as well on a strong print. And welcome, Gary. Gary, just related to how deeply embedded and strategic you see Splunk into its customers, I wanted to double-click a bit more on the leverage that you see in the model and the potential you see there. You talked about the efficiency and productivity of the investment Splunk makes and I think your reputation along these lines precedes itself. And we got the examples of maybe not backfilling some of the roles and departures. But anything else you can share would be really helpful.

Gary Steele

Yes, a couple of things. So one is the role that we're playing for these mission-critical customers and the role that Splunk plays, it has -- it puts us in a really unique position where there's tremendous future opportunity. And as we think about the long-term model here, and I indicated this in the prepared remarks, I do believe that we have tremendous opportunity for long-term durable growth. But importantly, increasing cash flow and cash flow margins overall -- operating margins overall.

And I think there's efficiencies to be had in the organization. As I indicated, we're taking the first step by flattening the organization. I think that's one step forward in helping us operate more efficiently with more agility, with more speed in decision-making. And I think over the long haul, that does translate into a lot of financial benefits for our shareholders.

Operator

Our next question comes from the line of Raimo Lenschow from Buckley.

Raimo Lenschow

Thank you, and Gray, good to talk again. My question was, if I listen to you today, it's obviously as a new CEO is like your first conference call around Splunk desk. There seem to be a little bit more focus on security. Can you maybe talk a little bit about how penetrated you see Splunk, like you can bring a kind of security lens to it? And also, like how much of that is kind of due to the fact that in these more volatile times, we have obviously the situation that security spending will probably still be prioritized over other areas? Just a little bit of your take on that one.

Gary Steele

Yes. It's a really good question. Nice to talk to you again. I believe coming from a cyber background that Splunk has always had a very unique position, but I also believe there's more that we can do to create a tighter partnership with customers and ultimately drive more value from the security buyers. And so I'm personally very optimistic given the role that we play today and how we're positioned in those customers.

And to your point, I fundamentally also believe that security will be much more resilient than other things, other areas if there's more turbulent economic conditions. So I'm really excited about the opportunity, the role that we play and the fact that we're giving customers visibility they can't get from any other set of capabilities. So that uniqueness for me gets me very excited about the future and the role that we can play with security. I think what you're hearing partially is my voice just coming from a security background. I think we can elevate and emphasize some of those things within Splunk, and there's short-term opportunity there.

Raimo Lenschow

Yes. And then one follow-up for Jason. If I look -- the question I'm getting from investors is around cloud. And like you know, software companies are doing beat and race war. If you look at your quarter, like cloud was kind of reconfirmed, is there anything that you want to point out in terms of from a macro perspective that you're seeing there? Is it just kind of early in the year? Just what's the take on the guidance -- on the different drivers for the guidance?

Jason Child

Sure. Yes. I would say, first, as it comes to cloud, very happy with the performance in Q1. Cloud mix of 57% was just up a tip over a year ago. But really, the motion for our Cloud business really is tied very much due to -- or to the renewal base. And our renewal base is the smallest in Q1, and it really starts to go throughout the year. So I would call -- we did reaffirm cloud guidance for full year at reaching the $2 billion number, which puts us in a pretty unique place and already imply strong growth. But we do expect, as you see the cloud mix grow throughout the year, I think we said last quarter and no change to our assumption that we expect cloud mix to be approaching 70% by year-end, that we'll continue to see strength in the cloud business.

Raimo Lenschow

Super helpful. Congrats from me and all the best, Gary.

Operator

Our next question comes from the line of Phil Winslow from Credit Suisse.

Phil Winslow

Thanks for taking my question and congrats on a great start to the year. And Gary, very excited to be working with you again. Yes, we'll start with you. Obviously, we've had a lot of questions on this call about security. But the other Splunk-built solution on top of the platform, observability. I wonder if you guys just sort of your view on sort of what Splunk brings to the observability market relative to some of the competitors, what really stood out to you? And how is sort of the integration of all those acquisitions coming? And then I got a follow-up for Jason on the numbers.

Gary Steele

You got it, Phil. So one of the things that has been really interesting to me is to see the leverage that we're getting from these traditional security customers into observability. So the market opportunity is very simple in that when something goes bump in the night and there's an application failure, companies want to know, is that a security issue? Or is that just an application failure? And it's really looking at a lot of the same data.

So we benefit from being able to have that insight. And through that leverage, we're seeing lots of interest extending logs into metrics and traces to have a broader, more fully -- a full view of what's happening from an observability standpoint. So I feel like there's tremendous leverage. And to your point, relative to product, we're really the only vendor today out with logs, metrics, traces all integrated. So our progress on that has been tremendous.

And while we're still early in the market, we had some very nice wins in the quarter, and we're seeing the leverage that we have extending our footprint with the platform into the traditional observability market. So we feel really good about that positioning and I think it represents a really nice growth opportunity over the coming years.

Phil Winslow

And then Jason, a question for you. I often get this question on the DBNRR number in the cloud, obviously, super strong. And you still have continued growth in the non-cloud ARR base. How much of that cloud, DBNRR growth, is coming from people sort of lifting and shifting from on-prem or is that still the vast majority, just call it net new? In other words, a clean sort of apples-to-apples DBNRR number?

Jason Child

Yes. I mean, so overall, our overall DBNRR is growing within a few hundred basis points of the cloud DBNRR rate, that's been consistent for a while. If you then unpack how much of the cloud business is growing kind of on a durable basis without migrations, it's a little harder to figure that out, but our analysis indicates that it's maybe a couple of hundred basis points of tailwind, but not a material impact on the overall DBNRR number.

Phil Winslow

Got it. So in other words, the growth dynamics are sort of dependent on the cloud itself versus migration? Great.

Jason Child

That's right.

Operator

Our next question comes from the line of Keith Weiss from Morgan Stanley.

Sanjit Singh

This is Sanjit Singh with Morgan Stanley on for Keith. Gary, congrats on the role and really looking forward to working with you again. I have 2 questions, one for Jason, and then one for you, Gary. Jason, on the guidance, I was wondering if you could walk us through maybe some of the underpinning assumptions around guidance with respect to closure rates or any other sort of metrics and to what degree did you provide an extra layer of conservative or prudent just given all of sort of the macro uncertainty that's going out in the market? Just walk us through those assumptions.

And then for Gary, the question is really around what you sort of see the opportunity on the go-to-market side, you talked about flattening the organization. In terms of how fast should Splunk move to cloud versus continue to make this more of a choice for customers, what's the right balance for that when we think about the context of trying to improve operating margin and cash flow, sort of the pace of how this position move to cloud, I'd love to get your initial thoughts on that dimension.

Jason Child

Okay. So on the first question, I'm not going to be able to unpack it probably to the level that you would like for modeling, but I will tell you there's kind of 4 primary pieces. And so as we look at either -- whether it's ARR or net new ARR, ACV, whatever, we start with an overall renewal rate, which we've consistently had at a very, very high percentage of the 90-ish percent range. And then we factor in what is our expectations on expansion. And as you've seen with the DBNRR, that number has been relatively consistent.

We then have to layer in the new logo expectations, which that that's probably a little harder to do, especially if there is a slowdown in macro. And then lastly, expectations on churn, which is, I guess, kind of the inverse of that renewal rate, but that's usually been a pretty consistent single-digit percentage number. So across all those dimensions, we're not really seeing big changes, which is why we're reiterating the guidance and didn't change the numbers for full year.

And if something changes, we'll let you know, but at this point, we feel very good about the Q1 we delivered with a strong DBNRR, the RPO bookings of 32%. The revenue growth, highest revenue growth we've had in 3 years. So overall, I feel like the fundamentals are in a very, very good position.

Gary Steele

And to the other part of the question, one of the interesting things to think about is the way in which our largest customers want to deploy. And one of the things I've learned in my 6 weeks here is we see tremendous value in being able to support customers that have multi-cloud hybrid environments, which is almost every single large customer. They're operating across multiple clouds, and they continue to have significant operations on-prem. And so our ability to be able to bring all that together under a single architecture, provide federated search, so they can search from a single instance across all those environments is something that's super unique.

But in saying all that, it does create more complexity in what percentage it will ultimately be cloud. Because we do believe that over the long haul, these large customers will continue to maintain presence again in the cloud and on-prem. So we're not as hung up on what that exact number is because we understand that these large, incredibly strategic customers have complex environments that they need to be able to leverage Splunk in this broad hybrid world.

Now to your question about efficiency on go-to-market side, I do believe that by flattening the organization, we can drive a level of agility and decision-making that helps us get closer to our customers improves the customer experience. And ultimately, I think will be more in tune with helping them advance their architectures in this, what is a very complex world. And ultimately, we financially benefit from that. So I'm feeling incredibly excited about the role that we can play, drive customer experience and do it in a more efficient way than we've traditionally done it. So I'm -- while I'm early days here, super optimistic about that.

Operator

Our next question comes from the line of Kirk Materne from Evercore ISI.

Chirag Ved

This is Chirag Ved on for Kirk. Congratulations on a great quarter. Gary, maybe just one for you. Could you talk about the potential to get greater scale and efficiency through partners and how you're continuing to engage with the ecosystem to help you scale?

Gary Steele

Yes. No, it's a really good question. And I think it's an interesting point of leverage opportunity in the business. We've done a tremendous job of partnering with some of the largest GSIs in the world. We've seen very good early traction with the cloud players. We also obviously play in the security world with the security resellers. And so there's a variety of communities where we're playing a critical role.

And I think what's interesting here and the one thing that does differentiate Splunk is the opportunity to work with those partners where they can deliver services on the back of Splunk in these complex architectures, be it security or broader observability, it really creates a very compelling opportunity for partners. And I think we're at the beginning of that journey. I think there's a lot more we can do. And it's something that I'm frankly super excited about diving in on and supporting the team in those efforts. But we're -- I think we're very early in that opportunity.

Operator

Our next question comes from the line of Steve Koenig from SMBC.

Steve Koenig

Gary, congratulations on the new role. I got 2 questions for you. So one is about competition with the XDR vendors. What's your view of the difference between XDR and SIEM other than having an endpoint agent? And then I'll hit you with the next one after that.

Gary Steele

Yes. The one thing that I've seen here that I think is really important is in our SIEM world and the broad Splunk platform, we're able to take a vast variety of data to provide end-to-end visibility as to what the heck is happening in these complex environments. So as the attack surface has grown, having that broad visibility is absolutely critical, whether you're dealing with log, you're dealing with the ransomware issue or you're dealing with some other vulnerability environment.

And what is missing in the XDR world, it's a limited view. And so customers absolutely today require this broad visible view. And I think one of the things that Splunk got right way before I got here is not discouraging customers on data. So with the workload-based pricing, getting access to all that data and making it available across multiple clouds as well as hybrid. No one else can do that. And so I think we're in a very, very unique position relative to the XDR players.

Steve Koenig

Got it. That makes sense. And then my follow-up is really about the context here. You've been working in cyber for many years. And so I'm curious your view, I understand the product leverage you get from playing across ITOps, DevOps and SIEM. From a customer buying perspective, where are the security purchases depend on IT budgets? And then where are they separate? Is there some difference between enterprise and smaller companies? And how Splunk's go-to-market work within that dynamic?

Gary Steele

Yes. Really good question, Steve. And it's interesting because one of the things that I've been seeing, and I've been doing a lot of customer meetings. And so I've really been trying to get my arms around that exact question. And the thing that we see is sort of threefold. First of all, we always have a strong champion in security because of the role and the dependence the security team has on Splunk. Second, the IT teams have traditionally gotten a tremendous amount of value giving them visibility across that broader application environment.

And then as these new applications have been developed, leveraging modern cloud architectures, this requirement on having broader observability is absolutely critical. And so we really see kind of a -- we see 2 primary buyers. We see CISO playing a critical role, and we see CTO playing a critical role. And they're oftentimes just working in concert with one another. And that leverage is amazing, and I just -- I've seen it in lots of different customer examples day in and day out. So I think we're extremely uniquely positioned here and it represents a tremendous growth opportunity for the future as a result.

Operator

Our next question comes from the line of Matt Hedberg from RBC Capital.

Matt Hedberg

Great. Gary, congrats and really look forward to working with you again. So I guess you guys have obviously a blue chip list of customers and have made a tremendous push with Splunk Cloud. How do you think about accelerating new customer lands? It's been more of an upsell into the base, but that new customer land piece, how do you think about that?

Gary Steele

Yes. I think it comes in a couple of dimensions. I think in the world we're living in relative to the requirements around security, I think Splunk plays a critical role, and we'll continue to run the play of getting customers to adopt us as the core to their overall security strategy. I think that's one. Two is we're seeing tremendous interest on the durability side, we're landing customers in that regard as well. And we had some nice wins, a couple of which we talked about in the prepared remarks. So I think that motion, I think there's more work we can do there but I think the motion is in place.

Matt Hedberg

Got it. Okay. And then maybe for yourself or Jason. Speaking about the base, obviously, you have a large renewal opportunity this year. Can you talk about the health of the large deal pipeline and maybe some of the close rates that you saw and maybe some of the assumptions you're making for Q2?

Jason Child

Yes. On the renewal base is certainly the smallest in Q1 of any of the quarters this year. But I'd say in terms of closing deals, pretty much we're right on track in terms of -- we do track loss rates, not seeing -- it's not -- there's no competitive pressure on large deals that's really driving anything. It's mostly coming down to customers' timing, what their needs are, whether it's a cloud migration and what their capacity needs are. And from that perspective, it's kind of business as usual. I'm not really seeing any real shift there. I would say this is a pretty significant step-up in the renewal base, over doubling from -- to about $1.5 billion this year. And it's going to keep growing throughout the year progressively each quarter. But feel like we have a great start to the year, and all the indications look strong at this point.

Operator

Your next question comes from the line of Keith Bachman from BMO.

Keith Bachman

And I also want to ask 2 questions, and Gary, I'm going to start with you on the first one. Really great to hear about your orientation on improving margin, particularly free cash flow margin. With that said, one thing you mentioned was not replacing Shawn. And I wanted to hear a little bit more about what the plan there. I think there's been perhaps some -- or product development, go-to-market kind of execution issues. And I would call out observability while you called out some wins, I mean, feedback from the channel on observability is it still requires some integration work. And I'm just curious as to what your plan is, if you're not going to backfill Shawn, how do you make sure that Splunk continues to innovate well to try to capture opportunities?

Gary Steele

Yes. No, it's a great question. One of the things I'm actually personally super excited about is rolling up my sleeves and working closely with the engineering leaders to drive higher speed, agility and faster pace of innovation. And Splunkers here have done an amazing job historically. And I think that with some support driving decision-making, we can be in a really good position. And so I love to get my hands dirty and work directly with the engineering teams. And so I think that we're really well positioned to do that with a flatter organization. So I think it's a -- it will be a change, but I think it's a very -- it will be a very positive change for the company.

Keith Bachman

Okay. Obviously, a critical one. And my second question relates to that is the typical refrain as I'm sure you've gathered from investors, is that Splunk is losing share to a variety of competitors that are approaching -- increasingly approaching on the space. Now it's easy to understand how your gross retention is very, very high. But what's your take from what you've heard from customers in terms of workload retention? That is to say on winning new applications or winning new logos as the previous question. But could you talk a little bit about kind of your first quarter here of Splunk is how you view the competitive dynamics and Splunk's ability not only to maintain your customers, but more importantly, to keep growing your workloads to keep driving kind of 30-plus percent revenue towards type of growth? That's it for me.

Gary Steele

Yes. No, it's a good question. So in the time that I spent here, I've probably done, I don't know, maybe 40 customer meetings. And in all those customer meetings, every single one of them, we spent time talking about expansion of Splunk and new workloads where they've identified use cases where they want to leverage the power of Splunk to try to drive additional value for them. So I think the reality is Splunk is playing in this massive market, which is estimated -- on our estimates, it's about $100 billion.

And of course, there are other players going after that, but we're uniquely positioned to go continue to win these workloads given the loyal nature of these -- of our customers, the new customers we're signing and the fact that we continue to see growth in the workloads that they're putting on Splunk. So I think there's obviously lots of noise in the market, but I think we're incredibly well positioned, and I hear it directly from customers. And that's where I spent my time over my first 6 weeks.

Jason Child

The only thing I would add is just to restate the net retention. I mean net retention out only is 130. And then overall, it's worth a few hundred basis points, so call it high 120s. And that's including any competitive anything because that's net of churn. They may be chatted in the market, but feel pretty good about stacking up the DBNRR against anyone else at our size or close to it and feel like the numbers speak for themselves.

Operator

Our next question comes from the line of Brad Sills from Bank of America Securities.

Brad Sills

Congratulations, Gary, on your new role and nice first quarter as CEO. I wanted to ask about just the platform itself. There's been a lot of effort, a lot of investment made in retooling for the cloud, adding observability. Do you feel like the platform is in a place now where it needs to be? And from here, it's just kind of incremental improvements on those 2 in particular? Or are there some other efforts here that we should be thinking about as you continue to broaden the platform?

Gary Steele

No. I think when I look at current state of capabilities today, the one thing I'm encouraged by is the amount of progress that's been made prior to me joining. And we're excited next week, we have some exciting product announcements at .conf, which really play into this exact question. So stay tuned on that.

Brad Sills

Wonderful. And then, Jason, one for you, please. It looks like you're kind of tracking close to that ARR margin target this year, fiscal '23 that you laid forth a couple of years ago. The operating cash flow margin of ARR is quite a bit lower at that greater than $400 million level. Is there any reason to think that free cash flow couldn't come back more meaningfully than kind of where you've guided to this year? I guess where could we see upside potentially with free cash flow conversion as we move through the year?

Jason Child

Yes. Well, I would say our free cash flow conversion, I mean I think I've talked about in the past couple of quarters, there's a lot of puts and takes. And certainly, cloud gross margin is probably the biggest driver of -- because -- there's been a lot of complexity on migrations, which has short charge and pressure as you get through the migrations. And then once you're past the migration, you can kind of dial up elasticity when you have a better understanding on exactly what utilization looks like on a by-customer basis.

So in terms of getting back to the kind of 20-plus percent cash yield, it's definitely a question of when, not if. I don't have a specific time frame on that yet. At some point, we'll be able to give you some better future guidance. But the timing really is going to be tied mostly to kind of the cloud migration and then cloud margin timing. And that's when you'll see the cash yield get to that 20-plus percent rate that we talked about a couple of years ago.

Operator

Our next question comes from the line of Michael Turits from KeyBanc.

Michael Turits

So Gary, congrats on joining the company and on the role. One philosophical one for you, I think, Gary, on pricing. Splunk's been down for a while. Or at least customer feedback has been that pricing is high, it's difficult, but there's a structure to it. And have made changes, do you think they're there yet in terms of doing what needs to be done to convince customers that pricing gives them value? And then I have a broader question for I think maybe, Jason, both and Gary.

Gary Steele

Yes, I do. Great question. The move from ingest-based pricing to workload-based pricing has been incredibly important and strategic to customers. So it really now is encouraging customers to more broadly leverage their data. This is important as we think about the role that observability plays as well. It's important from a security point of view because you have broader access to all the data that you really need to have insight into.

And so I think there is some hangover. I think there's some -- still some sting out there. But the feedback on workload-based pricing has been very, very good. And as you think about cloud, all the largest deals are all workload pricing. So I think we've made very good progress, and it's been a journey, but I think we've been making good progress on this.

Michael Turits

Great. And then the follow-up, I guess, for both of you guys, in a way for Jason because he's been through this with Splunk before. But on the macro side, I mean, just now on the other data cloud comments about consumption getting weaker in this environment. And Jason, you went through this in '20 where things seem fine at first, but in some senses go weaker at some point a couple of quarters later. So are you either seeing anything or anticipating and changing your tactics in any way such to anticipate either smaller deals, longer sales cycles as we're hearing from other data provider today, a lower consumption rates?

Gary Steele

Yes. That's a good question. I'll start and Jason will have a couple of comments as well. It's interesting. We watch very closely at the close of the quarter. So I joined 2 weeks prior to the end of the quarter, so I had the opportunity to see the dynamics of all deals as they lined up as we closed the quarter. And we literally heard no one talk about changing financial priorities, budgets pulled, projects pulled. We heard none of that, literally absolutely none of it. Now we're obviously being cautious given the broader set of market conditions, but we saw no change in buyer behavior as we worked our way through the end of the quarter. And Jason, I'll let you dive in.

Jason Child

Yes. On the -- on overall basis, we did obviously take up our guidance on revenue and op margin but we maintained ARR and cash flow. And I would say from what I saw in the quarter and what we're assuming as we are now well into Q2 is not really any big changes. And I think certainly, what we saw a couple of years ago was very pronounced and very immediate. I don't see anything like that. Our assumptions really are the growth for the balance of the rest of the year. I think the biggest swing factor we're still trying to understand is to what extent our large-scale cloud migrations affected. And we'll learn more about that as we progress throughout the year because, as I said earlier, the renewal base really kind of steps up each quarter and really kind of peaks in Q4. But so far, haven't really seen any real significant macro impacts.

Operator

Our final question for today comes from the line of Rob Owens from Piper Sandler.

Rob Owens

I want to add on to Michael's question. I guess, just through the lens of headcount growth and hiring and whether you're going to hire ahead or you're being a little bit more conservative in this environment.

Jason Child

I would say from a CFO's perspective, we're a growth company. We have a forecast that we're maintaining from a growth perspective. So we're going to continue to be hiring certainly on the selling capacity side. And we still do have a platform that we're in, fairly well into the process of modernizing, but there's still work to do, especially on the observability side. So we're going to be making investments in those areas, and I don't expect that to change. Anything else, Gary?

Gary Steele

No, I think -- Rob, it's good to talk you again. I would say when we look at the overall hiring environment, et cetera, we're being thoughtful about it, but we're not tapping the brakes at this point.

Operator

This does conclude the question-and-answer session of today's program. I'd like to hand the program back to Gary Steele for any further remarks.

Gary Steele

Let me reiterate that this is the best time to be here at Splunk. As our momentum demonstrates, we are mission critical to our customers' operations already, and there's a massive market opportunity to provide a foundation of security and resilience so customers can innovate with speed and agility. I'm looking forward to working with customers, partners and employees to use Splunk to help reach even more mission-critical outcomes. Thank you all for your support and hope to see you at .conf.

Operator

Thank you, ladies and gentlemen, for your participation in today's conference. This does conclude the program. You may now disconnect. Good day.